CVE-2026-39910: STACKIT IaaS API Privilege Escalation via Service Account Attachment

Synopsis

Missing authorization check in the STACKIT IaaS API allows a network-accessible attacker with no privileges to attach arbitrary service accounts to virtual machines they control, then retrieve high-privileged OAuth2 tokens via the Instance Metadata Service. Successful exploitation grants full organization-level access, crossing tenant boundaries and enabling unauthorized control over all resources in the affected environment. A patched-image rebuild at version 2026-05-28 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable API endpoint is exposed over the network, so the attacker must be able to reach the STACKIT IaaS API service across a network connection.

• AuthenticationNot required

  No authentication is required; the CVSS vector specifies PR:N, meaning any unauthenticated network client can invoke the vulnerable endpoint (the description notes low-privileged context is sufficient, and the vector confirms no credential barrier).

• Victim interactionNot required

  No victim interaction is needed; the attacker exercises the vulnerable endpoint directly without any user action.

• Attack complexityDetail

  Attack complexity is low (AC:L), meaning the exploit is reliable and imposes no race-condition or environmental precondition on the attacker.

Blast Radius

• Attacker retrieves valid high-privileged OAuth2 tokens from the Instance Metadata Service, gaining authenticated access to the full STACKIT organization.
• Attacker reads sensitive data across all projects and tenants in the organization, including stored credentials, configuration, and customer records.
• Attacker modifies or deletes virtual machines, service accounts, and other infrastructure resources across tenant boundaries.
• Attacker disrupts availability of running workloads throughout the organization by terminating or reconfiguring compute resources.